The more I look into this the messier it gets :(

Do we want to take the time to refactor lockbox/install_attributes/mount-encrypted, or do the quick and easy route? Lockbox already calls out to mount-encrypted to do finalization, so it wouldn't be unthinkable to have it stop pretending to be totally index-agnostic.

At this point the fastest route to get mount-encrypted working would be best IMO, as long as the design is being followed. The call-out that cryptohomed does to mount-encrypted doesn't touch the TPM at all (afaict) so that part shouldn't need to change.

+keescook - FYI

cryptohomed touches the TPM (finalizes the lockbox), but the call to mount-encrypted doesn't touch the TPM: it's just cleaning up the key files on disk.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/5d996696083b544179da32ece60247b166a17d57

commit 5d996696083b544179da32ece60247b166a17d57
Author: Stephen Barber <smbarber@chromium.org>
Date: Thu Aug 04 23:05:01 2016

tlcl: add implementations for GetOwnership and Read/WriteLock

mount-encrypted needs to be aware of TPM ownership status, and
will also want to issue a read lock for the early access NVRAM
index.

BRANCH=none
BUG= chromium:625037 
TEST=mount-encrypted shows ownership at boot with kevin

Change-Id: I42f43f91d892137e1c46c7cacd88e3b749ce7f04
Reviewed-on: https://chromium-review.googlesource.com/366443
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Andrey Pronin <apronin@chromium.org>

[modify] https://crrev.com/5d996696083b544179da32ece60247b166a17d57/firmware/lib/tpm2_lite/tlcl.c
[modify] https://crrev.com/5d996696083b544179da32ece60247b166a17d57/firmware/include/tpm2_tss_constants.h
[modify] https://crrev.com/5d996696083b544179da32ece60247b166a17d57/firmware/lib/tpm2_lite/marshaling.c

FYI: I've mostly put this on the back burner as I deal with other kevin issues. I'm happy to tackle it once some of that has died down, but if it's urgent I can start working on this again.

Fixed. Tracked here:
http://crosbug.com/p/54708
http://crosbug.com/p/59062
http://crosbug.com/p/59973